infra/hosts/wob-vpn-gw/default.nix

{ pkgs, lib, ... }:

{
  imports = [
    ./netboot.nix
  ];

  ###### Hardware ######
  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "sd_mod" "sdhci_pci" ];
  boot.kernelModules = [ "kvm-amd" ];

  boot.loader.grub.device = "/dev/sda";

  fileSystems."/" =
    { device = "/dev/disk/by-uuid/58688a5c-e3ce-4868-804b-4e34d1370f36";
      fsType = "f2fs";
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/38caa628-3b6d-4fb4-8767-beee09a196a6";
      fsType = "ext2";
    };

  nixpkgs.hostPlatform = "x86_64-linux";

  hardware.cpu.amd.updateMicrocode = true;

  # Enable serial output
  boot.loader.grub.extraConfig = ''
    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
    terminal_input serial
    terminal_output serial
  '';
  boot.kernelParams = [
    "console=ttyS0,115200"
    "console=tty1"
  ];

  ###### Config #######

  boot.initrd.systemd.enable = true;

  networking.useNetworkd = true;

  systemd.network = {
    netdevs = {
      "40-uplink" = {
        netdevConfig = {
          Kind = "bond";
          Name = "uplink";
        };
        bondConfig = {
          Mode = "802.3ad";
          TransmitHashPolicy = "layer3+4";
        };
      };
      "40-oob" = {
        netdevConfig = {
          Kind = "bond";
          Name = "oob";
        };
        bondConfig = {
          Mode = "802.3ad";
          TransmitHashPolicy = "layer3+4";
        };
      };
    };
    networks = {
      "40-enp1s0" = {
        name = "enp1s0";
        bond = [ "uplink" ];
      };
      "40-enp2s0" = {
        name = "enp2s0";
        bond = [ "uplink" ];
      };
      "40-enp3s0" = {
        name = "enp3s0";
        bond = [ "oob" ];
      };
      "40-enp4s0" = {
        name = "enp4s0";
        bond = [ "oob" ];
      };
    } // lib.listToAttrs (map (x: lib.nameValuePair "40-bmc${toString x}" {
      name = "bmc${toString x}";
      address = [ "192.168.1.${toString (x*4 + 1)}/30" ];
      #address = [ "192.168.${toString x}.1/24" ];
      networkConfig.DHCPServer = true;
    }) (lib.genList lib.id 12));
  };

  networking.nftables.enable = true;
  networking.firewall.extraInputRules = ''
    iifname { "bmc*" } meta nfproto ipv4 udp dport 67 accept comment "DHCP server"
  '';

  networking.vlans = lib.listToAttrs (map (x: lib.nameValuePair "bmc${toString x}" {
    interface = "oob";
    id = 101 + x;
  }) (lib.genList lib.id 12));

  networking.interfaces = {
    uplink = {
      ipv6.addresses = [
        {
          address = "2a01:584:11::2";
          prefixLength = 64;
        }
      ];
    };
  };

  networking.defaultGateway6 = { interface = "uplink"; address = "2a01:584:11::1"; };

  networking.hostName = "vpn-gw";
  networking.domain = "wob01.infra.forkos.org";

  deployment.targetHost = "2a01:584:11::2";

  bagel.sysadmin.enable = true;

  environment.systemPackages = [ pkgs.ipmitool ];

  system.stateVersion = "24.05";
}